Nagios Core
Nagios Core is an open-source monitoring system written in C. It has been around since 1999 (it was called NetSaint back then) and a lot of people still use it to monitor their servers and networks.
I am the current maintainer of Nagios Core. I put out the last three releases, which were 4.5.12, 4.5.13 and 4.5.14.
Releases
| Version | Date | Notes |
|---|---|---|
| 4.5.14 | Aug 5, 2026 | Security fixes, including a reflected XSS in cmd.cgi and sanitizing notification macros. Also a community fix for checks that stopped running if the last check time was in the future. |
| 4.5.13 | May 28, 2026 |
More CSRF cookie fixes and sanitization for custom variables.
Added the cgi_cookie_fail_open option.
|
| 4.5.12 | Mar 25, 2026 | CSRF cookie fixes, plus a community fix for a compile error in runcmd. |
Security Fixes
Most of my work on these releases went into fixing vulnerabilities that security researchers reported to us. A lot of it came down to making sure user input gets sanitized before Nagios does anything with it.
The CSRF cookie for cmd.cgi took up a good chunk of all three
releases. cmd.cgi doesn't only get used by the web interface. Some
third-party tools send commands to it directly, and the stricter
CSRF checks broke them. For 4.5.13 I added the
cgi_cookie_fail_open option so people who rely on
those tools can turn it on, while everyone else keeps the stricter
behavior by default.